ICMP fragment

[lcaruso]

Hi,

For a new install I did today, I'm getting messages from IDS

4    Feb 10 2011    19:54:30        172.X.5.2        172.Y.6.247        IDS:2150 ICMP fragment from 172.X.5.2 to 172.Y.6.247 on interface outside

across a ipsec site-to-site tunnel so the traffic is trusted.

These are older XP workstations.

Any chance it's just a non-compliant TCP/IP stack instead of a real threat?

[Jennifer Halim · Accepted solution]

It is worth investigating whether the ICMP traffic is actually generated by someone or applications, or it could be a DOS attack generated by an unwanted applications.

If it's actually legitimate ICMP traffic generated by someone or a known applications, then it's not a threat.

Here is more information on signature# 2150:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=2150&signatureSubId=0&softwareVersion=6.0&releaseVersion=S2

[lcaruso]

thanks for the link...didn't know about that section of the website

[Jennifer Halim · Accepted solution]

Here is the Cisco SIO (Security Intelligence Operations) website which has search function for various vulnerabilities, etc:

http://tools.cisco.com/security/center/home.x

Hope that helps.